Dashboards & Visualizations

How to not include LD_PRELOAD in Error Alerts?

aditsss
Motivator

Hi All,

I have created Alerts on the basis of Error keyword . Below is one of my alert

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR"|rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")| cluster showcount=t t=0.4|table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns |dedup Error_Message| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count

On the basis of above query I am getting one of the Error message as shown below:

message = ERROR: ld.so: object 'libnss_wrapper.so' from LD_PRELOAD cannot be preloaded: ignored.

I want Error message with LD_PRELOAD should not come in Alerts.

Can someone guide me what should I change in my alerts

 

 

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Just like you have an exclusion for "INTERNAL_SERVER_ERROR", add a similar exclusion for "LD_PRELOAD".

index=abc ns=blazegateway-c2 CASE(ERROR) NOT "INTERNAL_SERVER_ERROR" NOT "LD_PRELOAD"
| rex field=_raw "(?<!LogLevel=)ERROR(?<Error_Message>.*)"
| eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")
| cluster showcount=t t=0.4
| table app_name, Error_Message ,cluster_count,_time, environment, pod_name,ns | dedup Error_Message
| rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name, cluster_count as Count
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...